Default settings and app installation

Configure default settings for Splunk Enterprise deployments and install apps using the Splunk Operator.

SmartStore index management

You can manage indexes through the Splunk Operator. Every index configured through the Splunk Operator must be SmartStore enabled. For more information, see Configure SmartStore for the Splunk Operator.

Using default settings

The Splunk Enterprise container supports many default configuration settings used to set up and configure new deployments. For a full specification of available settings, see default.yml.spec.md in the splunk-ansible repository.

To supply defaults with a ConfigMap, create the ConfigMap from your default.yml file:

kubectl create configmap splunk-defaults --from-file=default.yml

Mount the ConfigMap as a volume on your Custom Resource and set defaultsUrl to the full path of the mounted file. The following example shows a Standalone resource with volumes and defaultsUrl:

apiVersion: enterprise.splunk.com/v4
kind: Standalone
metadata:
  name: example
  namespace: splunk-operator
  finalizers:
  - enterprise.splunk.com/delete-pvc
spec:
  volumes:
    - name: defaults
      configMap:
        name: splunk-defaults
  defaultsUrl: /mnt/defaults/default.yml

The volume mounts the ConfigMap under /mnt/defaults. The defaultsUrl value must be the full path to the defaults file inside the container.

You can specify multiple paths or URLs in defaultsUrl as a comma-separated list:

defaultsUrl: "http://myco.com/splunk/generic.yml,/mnt/defaults/apps.yml"

Inline defaults that you define on the Custom Resource are processed last, after any files or URLs listed in defaultsUrl.

Installing Splunk apps

In Splunk Operator version 2.0 and higher, you can the App Framework to centrally store and deploy apps. For more information and examples, see App Framework.